diff --git a/crates/agent/src/templates.rs b/crates/agent/src/templates.rs
index 6ab4cdd3f1..582c12f4fe 100644
--- a/crates/agent/src/templates.rs
+++ b/crates/agent/src/templates.rs
@@ -216,8 +216,6 @@ mod tests {
         assert!(
             rendered.contains("worktree metadata that may live outside the project directories")
         );
-        assert!(rendered.contains("inherited SSH agent socket"));
-        assert!(rendered.contains("does not allow packet-sending network access"));
         assert!(rendered.contains("for the rest of the thread"));
     }
 
diff --git a/crates/agent/src/templates/system_prompt.hbs b/crates/agent/src/templates/system_prompt.hbs
index ef31bc0a36..c615d0958f 100644
--- a/crates/agent/src/templates/system_prompt.hbs
+++ b/crates/agent/src/templates/system_prompt.hbs
@@ -199,7 +199,7 @@ You can request elevated permissions on individual `terminal` calls:
 - `allow_all_hosts: true` — lift the network restriction entirely: outbound access to any host over any protocol, so SSH, FTP, and raw sockets work too (unlike `allow_hosts`, which is HTTP/HTTPS-only). Use only when the specific hosts can't be enumerated up front.
 {{/if}}
 - `fs_write_paths: ["/abs/or/worktree-relative/path", ...]` — allow writes to specific paths (each directory grants its whole subtree). Prefer this whenever you know which paths the command needs to write.
-- `allow_git_access: true` — lift the default block on Git metadata, allowing reads and writes of file contents under `.git` directories (including worktree metadata that may live outside the project directories). Any command that touches `.git` needs this, including ones that invoke Git only incidentally (e.g. build scripts calling `git describe`/`git rev-parse`, or commit hooks). When approved, the inherited SSH agent socket also becomes reachable for SSH-based Git commit signing (local Unix-socket IPC only — it does not allow packet-sending network access); GPG commit signing via gpg-agent is not available in the sandbox.
+- `allow_git_access: true` — lift the default block on Git metadata, allowing reads and writes of file contents under `.git` directories (including worktree metadata that may live outside the project directories). Any command that touches `.git` needs this, including ones that invoke Git only incidentally (e.g. build scripts calling `git describe`/`git rev-parse`, or commit hooks).
 - `allow_fs_write_all: true` — allow unrestricted filesystem writes. Only use this when the specific paths can't be enumerated up front.
 - `unsandboxed: true` — run the command with no sandbox at all. Use only when none of the above suffice.
 
diff --git a/crates/sandbox/src/macos_seatbelt.rs b/crates/sandbox/src/macos_seatbelt.rs
index a5f15384f0..ec4605f198 100644
--- a/crates/sandbox/src/macos_seatbelt.rs
+++ b/crates/sandbox/src/macos_seatbelt.rs
@@ -195,9 +195,8 @@ pub fn wrap_invocation(
 /// denied even when they would otherwise be readable or writable; file
 /// metadata remains readable. Unix domain socket paths in
 /// `allowed_unix_socket_paths` are reachable for local IPC even when IP
-/// network access is otherwise blocked; callers use this for trusted sockets
-/// inherited from the process environment, such as `SSH_AUTH_SOCK`. This does
-/// not permit sending packets to other machines.
+/// network access is otherwise blocked. This does not permit sending packets
+/// to other machines.
 ///
 /// Network access and unrestricted filesystem writes must be requested via
 /// [`SandboxPermissions`].
@@ -453,11 +452,11 @@ mod tests {
     #[test]
     fn test_generate_seatbelt_config_allows_unix_socket_paths_without_network() {
         let dir = PathBuf::from("/Users/test/projects/myproject");
-        let ssh_auth_socket = PathBuf::from("/private/tmp/com.apple.launchd.test/Listeners");
+        let socket_path = PathBuf::from("/private/tmp/com.example.test/Listeners");
         let config = generate_seatbelt_config(
             &[dir.as_path()],
             &[],
-            &[ssh_auth_socket.as_path()],
+            &[socket_path.as_path()],
             SandboxPermissions::default(),
         )
         .unwrap();
@@ -466,8 +465,8 @@ mod tests {
         assert!(config.contains("AF_UNIX"));
         assert!(config.contains("(allow network-outbound"));
         assert!(config.contains("remote unix-socket"));
-        assert!(config.contains("(literal \"/private/tmp/com.apple.launchd.test/Listeners\")"));
-        assert!(!config.contains("(subpath \"/private/tmp/com.apple.launchd.test/Listeners\")"));
+        assert!(config.contains("(literal \"/private/tmp/com.example.test/Listeners\")"));
+        assert!(!config.contains("(subpath \"/private/tmp/com.example.test/Listeners\")"));
         assert!(!config.contains("(allow network*)"));
     }
 
@@ -491,8 +490,6 @@ mod tests {
             .set_nonblocking(true)
             .expect("listener should switch to non-blocking");
 
-        // Allow both the path the command connects to and its canonical form,
-        // mirroring how the real caller resolves `SSH_AUTH_SOCK`.
         let canonical_socket_path = socket_path
             .canonicalize()
             .expect("bound socket path should canonicalize");
diff --git a/crates/sandbox/src/sandbox.rs b/crates/sandbox/src/sandbox.rs
index 9979715fd4..c240e94160 100644
--- a/crates/sandbox/src/sandbox.rs
+++ b/crates/sandbox/src/sandbox.rs
@@ -584,9 +584,6 @@ impl Sandbox {
             .collect();
         writable.extend(git_writable.iter().map(PathBuf::as_path));
         let protected: Vec<&Path> = git_protected.iter().map(PathBuf::as_path).collect();
-
-        // SSH-agent socket handling (commit signing) is deferred, so no unix
-        // sockets are allowed for now.
         let (program, args, config) = macos_seatbelt::wrap_invocation(
             &command.program,
             &command.args,
diff --git a/docs/src/ai/sandboxing.md b/docs/src/ai/sandboxing.md
index fe691b47a5..f602811154 100644
--- a/docs/src/ai/sandboxing.md
+++ b/docs/src/ai/sandboxing.md
@@ -112,7 +112,6 @@ Sandboxed terminal commands:
 When network access is approved on macOS, Zed uses an HTTP/HTTPS proxy so access can be limited to approved hosts.
 Tools that do not honor proxy environment variables, such as SSH, FTP, and raw socket clients, may not work even after host-specific network access is approved.
 For networked terminal commands, prefer HTTPS URLs over SSH URLs when possible.
-When Git metadata access is approved, Zed may also expose the inherited `SSH_AUTH_SOCK` Unix socket so workflows such as SSH commit signing can work without granting outbound network access.
 
 ### Linux {#linux}